CVE-2024-12210

CVE-2024-12210 affects the Print Invoice & Delivery Notes for WooCommerce WordPress plugin. It allows authenticated users with Subscriber+ privileges to remove the shop logo due to a missing capability check on the wcdn_remove_shoplogo AJAX action, impacting all versions up to and including 5.4.0...

CVE-2023-48750 WordPress Void Elementor Post Grid Addon for Elementor Page builder plugin <= 2.1.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in voidthemes Void Elementor Post Grid Addon for Elementor Page builder void-elementor-post-grid-addon-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Void Elementor Post Grid Addon for...

WordPress plugin Essential Blocks for Gutenberg 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2024-9082

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save of the component User Creation Handler. The manipulation of the argument Type with the input 1 leads to...

eLinkSmart Hidden Smart Cabinet Lock Security Vulnerability

eLinkSmart Hidden Smart Cabinet Lock is a hidden smart cabinet lock from China eLinkSmart. A security vulnerability exists in eLinkSmart Hidden Smart Cabinet Lock version 2024-05-22, which stems from the presence of an access control error and authorization check failure...

CVE-2024-39592

Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This allows an attacker to read sensitive information causing high impact on the confidentiality of the application...

CVE-2024-31859 Member promoted to channel admin via playbooks run linking to channel

Mattermost versions 9.5.x = 9.5.3, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin...

CVE-2024-20326

A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement whe...

CVE-2024-32731

SAP My Travel Requests does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation, the attacker can upload a malicious attachment to a business trip request which will lead to a low impact on the confidentiality,...

PT-2024-10483 · Sap · Sap Netweaver Application Server Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server Java affected versions not specified Description: The issue is related to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java. This allows an attacker with a standar...

Progress OpenEdge 11.7.x < 11.7.19 / 12.2.x < 12.2.13 / 12.8.x < 12.8.1 (000253075)

The version of Progress OpenEdge installed on the remote host is prior to 11.7.19, 12.2.13, or 12.8.1. It is, therefore, affected by a vulnerability as referenced in the 000253075 advisory. - In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms...

Code injection

Mattermost fails to properly authorize the requests fetching team associated AD/LDAP groups, allowing a user to fetch details of AD/LDAP groups of a team that they are not a member of...

CVE-2024-20828

Improper authorization verification vulnerability in Samsung Internet prior to version 24.0 allows physical attackers to access files downloaded in SecretMode without proper authentication...

"Failed to connect to the database." Updater Configuration Check

Challenge When updating Veeam Backup & Replication the Configuration Check fails with either: Failed to connect to PostgreSQL server localhost:5432. An existing connection was forcibly closed by the remote host SSPI authentication failed for user Cause The account being used to run the update...

CVE-2023-31403

SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be executed or be used by the installation...

CVE-2023-4836

The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced...

CVE-2023-4836 WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR

The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access to those filed by manipulating IDs which can easily be brute forced...

SICK APU Security Vulnerability

SICK APU is a railroad analysis system from SICK Germany. A security vulnerability exists in the SICK APU RDT400 that stems from a lack of authorization checks. An attacker could exploit the vulnerability to modify data via an HTTP request...

Acronis Agent Security Vulnerability

Acronis Agent is an agent software from Acronis Singapore. Acronis Agent suffers from a security vulnerability that stems from a lack of authorization leading to the disclosure and manipulation of sensitive information...

Acronis Agent Security Vulnerability

Acronis Agent is an agent software from Acronis Singapore. Acronis Agent suffers from a security vulnerability that stems from a lack of authorization leading to the disclosure and manipulation of sensitive information...